Allied Intelligence — 2026-04-17

Atlantic Council Ties GRU and FSB to Below-Threshold Cyber Operations Against Sweden, Poland, Norway, Denmark

An Atlantic Council analysis by Anna Wieslander, Aaron Korewa, and Justin Sherman attributes Russia's below-threshold cyber campaign against NATO European members to the GRU, described as the origin of most of Russia's most destructive cyber operations including the Ukrainian grid attacks, and increasingly to the FSB, which a Polish government report now says is expanding into disruptive operations against critical infrastructure. Named 2025-2026 incidents include a thwarted Swedish heating-plant attack and a coordinated Polish operation on December 29-30 targeting wind and solar farms, combined heat and power plants, and industrial control systems. The authors frame the campaign as hybrid warfare designed to pressure NATO without triggering Article 5.

Analysis
The clearest allied-service public baseline yet, per a single Atlantic Council analysis whose FSB assessment rests on a cited Polish government report rather than independent collection, is that Russia's sub-threshold energy targeting has become a two-agency mission: GRU (destructive operations, Ukrainian grid heritage) plus FSB now scaling into disruptive critical-infrastructure strikes, a structural change the Article 5 threshold debate has not caught up to. Sweden's heating-plant thwart and Poland's December 29–30 unsuccessful-but-coordinated wind, solar, and CHP strike together set a tempo defenders can track but not deter. Absent named attribution with OFAC consequences, Moscow very likely keeps escalating through the summer demand peak. The FSB expansion claim may instead reflect Polish political interest ahead of 2026 elections, with FSB involvement opportunistic rather than strategic and GRU the lead service, but that distinction becomes moot if Washington closes the attribution gap. A joint CISA-NCSC advisory naming the FSB subunit behind the Polish activity is likely within the next month and would be the clearest indicator the U.S. is moving from tracking to consequence-imposition.

1 sources

Dispatches from the front lines of Russia-linked cyberattacks on Europe - Atlantic Council